What the attacker wants
Content attackers call news, poll, or CMS actions with stolen keys or replayed session authority. The teaching surface is deliberately familiar JSON so buyers can see the gate without learning a new domain first.
Attacks · By business pattern
Content apps
Protect content actions without ambient session keys. Familiar JSON shapes (news, polls) sit behind the same gate — headlines are the toy; authority is the lesson.
~5 min readDeep-link: Replay
Opening
How it works today
Content backends often ship with a long-lived news API key or session cookie that authorizes every poll and fetch. Headlines become the ambient credential estate in miniature.
Why it fails against one-shot proofs
Same gate curriculum on a friendly surface: replace the ambient key, bind the content route, burn before validate, allow only earned calls. MCP tool chips can expose the action without embedding a secret. Dual plates here show before/after for the news gate.
Deep-link APIs, replay, and relay for the full family teaching; this page is the pedagogy pattern.
Content action behind a gate
How to read: before/after news/poll REST; gold burn-before-validate. Takeaway: same JSON shape, different authority object.
The news-gate plate is the before/after: ambient key crossed out, burn path earned.
Burn-before-validate stops replay
How to read: second-submit myths fail; ledger burn then reject. Takeaway: spent nonces do not authorize again.
Replay denial on the content route is the same lesson as any other workload — spent means spent.
Scoped claims
Every API key, bearer token, and service certificate is a secret that works from anywhere until you notice it is gone.ValidatedAmbient credentials authorize by possession alone; ENI6MA replaces that model with one-shot, request-bound proofs.
Burn-before-validate is the structural reason a second submission of the same envelope always fails.ShippingGate stage 5 spends the nonce in the durable ledger before stage 6 validates the proof.Holds under the reference architecture
Where it shows up
Same families; friendlier teaching surface.
Poll submissions spend nonces.
Bound to the content route.